name: Pull Request Labels

on:
  pull_request:
    types: [opened, labeled, unlabeled, synchronize]

jobs:
  security-assessment:
    runs-on: ubuntu-latest

    permissions:
      pull-requests: read

    steps:
      # v2=7b0461786d3bd0c6a8487e9b57814ba3e2c00227
      - uses: mheap/github-action-required-labels@80a96a4863886addcbc9f681b5b295ba7f5424e1
        with:
          mode: exactly
          count: 1
          labels: "security-assessment-completed"
  do-not-merge-guardrail:
    runs-on: ubuntu-latest

    permissions:
      pull-requests: read

    steps:
      # v2=7b0461786d3bd0c6a8487e9b57814ba3e2c00227
      - uses: mheap/github-action-required-labels@80a96a4863886addcbc9f681b5b295ba7f5424e1
        with:
          mode: exactly
          count: 0
          labels: "do-not-merge"
  change-description:
    runs-on: ubuntu-latest

    permissions:
      pull-requests: read

    steps:
      # v2=7b0461786d3bd0c6a8487e9b57814ba3e2c00227
      - uses: mheap/github-action-required-labels@80a96a4863886addcbc9f681b5b295ba7f5424e1
        with:
          mode: exactly
          count: 1
          labels: "change:feature,change:bugfix,change:refactor,change:chore,change:docs,change:other"
  impact-defined:
    runs-on: ubuntu-latest

    permissions:
      pull-requests: read

    steps:
      # v2=7b0461786d3bd0c6a8487e9b57814ba3e2c00227
      - uses: mheap/github-action-required-labels@80a96a4863886addcbc9f681b5b295ba7f5424e1
        with:
          mode: exactly
          count: 1
          labels: "impact:users,impact:internal"
